Windows Server禁止更新（复杂版）

一、禁用或卸载defender，它自动更新自身不受windows update限制
参考https://cloud.tencent.com/developer/article/2345683 开头的【禁止或卸载Microsoft Defender】
一般只建议禁用，卸载要谨慎

二、禁止windows update相关服务开机启动
#查询update相关服务
Get-Service "UsoSvc", "WUAUSERV", "WaaSMedicSvc" -ErrorAction SilentlyContinue
Stop-Service -Name UsoSvc -ErrorAction SilentlyContinue
Stop-Service -Name WUAUSERV -ErrorAction SilentlyContinue
Stop-Service -Name WaaSMedicSvc -ErrorAction SilentlyContinue
Get-Service "UsoSvc", "WUAUSERV", "WaaSMedicSvc" -ErrorAction SilentlyContinue

#禁用update相关服务
Set-Service -Name UsoSvc -StartupType Disabled -ErrorAction SilentlyContinue
Set-Service -Name WUAUSERV -StartupType Disabled -ErrorAction SilentlyContinue
Set-Service -Name WaaSMedicSvc -StartupType Disabled -ErrorAction SilentlyContinue

#禁用update相关计划任务
Get-ScheduledTask -TaskPath "\Microsoft\Windows\UpdateOrchestrator\","\Microsoft\Windows\WindowsUpdate\" 2>$null | Disable-ScheduledTask 2>$null | ft -auto


三、禁止自动更新NVIDIA显卡驱动
reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" /v "ExcludeWUDriversInQualityUpdate" /d 1 /t REG_DWORD /f
reg add "HKLM\Software\Microsoft\PolicyManager\default\Update" /v "ExcludeWUDriversInQualityUpdate" /d 1 /t REG_DWORD /f

reg add "HKCU\SOFTWARE\NVIDIA Corporation\Global\GFExperience" /v "NotifyNewDisplayUpdates" /t REG_DWORD /d 0 /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\NVIDIA Corporation\Global\CoProcManager" /v "AutoDownload" /t REG_DWORD /d 0 /f

四、禁止Edge浏览器、Chrome浏览器自动更新
Get-Service MicrosoftEdge*, edgeupdate* | Set-Service -StartupType Disabled
Get-Service GoogleChrome*, gupdate* | Set-Service -StartupType Disabled
Get-ScheduledTask | Where-Object { $_.TaskName -like "MicrosoftEdgeUpdateTaskMachine*"} | Disable-ScheduledTask 2>&1 >$null
Get-ScheduledTask | Where-Object { $_.TaskName -like "GoogleUpdateTaskMachine*"} | Disable-ScheduledTask 2>$null

五、禁止ProgramDataUpdater
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AppCompat" /v DisablePCA /t REG_DWORD /d 1 /f
Stop-Service -Name PcaSvc 2>$null
Set-Service -Name PcaSvc -StartupType Disabled 2>$null
Get-ScheduledTask | Where-Object { $_.TaskName -like "*ProgramDataUpdater*"}| Disable-ScheduledTask 2>$null

六、禁止visual studio相关计划任务BackgroundDownload
Get-ScheduledTask | Where-Object { $_.TaskName -like "*BackgroundDownload*"}| Disable-ScheduledTask 2>$null

七、禁止windows update相关计划任务（需要提权）
参考https://cloud.tencent.com/developer/article/2323248

八、卸载可能操控windows update的第三方系统管家软件比如iOA等

先在cmd执行这句命令，打开一个powershell窗口
提权有2种，可以2个级别都试试
【提权到trustedinstaller】
AdvancedRun.exe /Clear /EXEFilename "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /StartDirectory "C:\" /CommandLine "" /RunAs 8 /Run
【提权到system】
AdvancedRun.exe /Clear /EXEFilename "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /StartDirectory "C:\" /CommandLine "" /RunAs 4 /Run

然后上一步打开的powershell窗口里执行第2句
Get-ScheduledTask -TaskPath "\Microsoft\Windows\UpdateOrchestrator\","\Microsoft\Windows\WindowsUpdate\" | Disable-ScheduledTask 2>$null